A living off the land (LotL) attack is a technique in which attackers use legitimate tools already installed on a system, such as PowerShell, WMI (Windows Management Instrumentation) or certutil, instead of deploying their own malware. Because these tools are trusted, traditional antivirus rarely blocks them, so detection depends on spotting abnormal behavior, like an office PC running encoded PowerShell commands at night.
How TecnetOne handles it: TecnetSOC
LotL, LOLBins, LOLBAS, living off the land binaries, fileless attack, dual-use tools